netdev - Re: : getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 7 Jan 2019 12:17:53 +0100
From:   Florian Westphal <fw@...len.de>
To:     "Mohandass, Roobesh" <Roobesh_Mohandass@...fee.com>
Cc:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: : getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is
 in fact sometimes returning the source IP instead the destination IP

Mohandass, Roobesh <Roobesh_Mohandass@...fee.com> wrote:
> Issue: getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP

SO_ORIGINAL_DST returns the original address (before DNAT/REDIRECT rewrite)
that conntrack believes to be the originator.

> What you expected to happen:
> getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) - should return always destination IP(connected IP).
> 
> What happened instead:
> getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, sa, &salen) is in fact sometimes returning the source IP instead the destination IP. Using getsockname() instead looks like solving the issue.
> 
> For just an example: 
> Out of 6569124 requests , 4 requests were wrong 0.000060891 % (this is just an rough estimate to give you idea on frequency)
> 
> Some old reference: (similar behavior observed) 
> https://stackoverflow.com/questions/11417187/getsockopt-so-original-dst-occasionally-returns-client-address

I ask exactly same question as in your url.
If you use TPROXY, why do you use SO_ORIGINAL_DST?

Its only required with -j REDIRECT.

If you need to use REDIRECT for some reason, make sure you limit
REDIRECT to -p tcp --syn to prevent it from triggering on other packets.

You might also want to turn off midstream pickup (sysctl
nf_conntrack_tcp_loose=0) in conntrack.